feat: close the last route gaps — 100% client route+verb coverage

Every HTTP request the 2023-03-21 client can issue now reaches a handler under
the verb it actually uses: 522/522, with an empty KnownGaps allowlist. The
coverage test asserts it, so a regression fails the build rather than becoming
a 404 in the wild.

The six routes left after the previous pass all needed storage that did not
exist, so they are done here as one schema change rather than stubbed:

- ClubRolePermissionEntity (ClubId, MembershipType, six bools) backs
  PUT club/{id}/permissions/{role}. A club with no stored row falls back to the
  derived default policy, so every club that predates the table behaves exactly
  as before. Partial writes keep the values they currently resolve to, so a
  client that omits a field cannot silently revoke a permission.
- ClubAdditionalImageEntity (ClubId, Slot, ImageName) backs the gallery. The
  details envelope now emits real {ImageName, Slot} rows instead of an empty
  array, and DELETE clears a slot.
- ClubEntity.MinLevel and ClubEntity.ClubChatEnabled back their setters and are
  read back by hasDisabledClubChat and the Club wire shape, which previously
  reported hardcoded defaults.
- ChatMessageEntity.ModerationState backs PUT thread/message/{id}/moderate,
  gated so an author can retract their own message but only club moderators and
  admins can action anyone else's.
- TestCaseEntity.CommentsJson backs the QA comment endpoint, appending rather
  than overwriting so a second tester's note cannot erase the first.

Also corrects the Joinability comment on ClubEntity, which documented
1=RequestToJoin / 2=InviteOnly. The real enum is Open=0, InviteOnly=1,
AskToJoin=2 — the inverted reading the requesttojoin handler was already fixed
away from, left behind where it could mislead the next change.

DorkNet.Server/Data/Entities/ClubEntity.cs

@@ -61,7 +61,9 @@ public class ClubEntity
     public int Visibility { get; set; } = 0;
 
     /// <summary>Club joinability enum on the wire (<c>Joinability</c>).
-    /// 0=Open, 1=RequestToJoin, 2=InviteOnly.</summary>
+    /// 0=Open, 1=InviteOnly, 2=AskToJoin — confirmed from the 2023 dump
+    /// (enum FEHIHCMDOLN). This comment previously had 1 and 2 swapped, which
+    /// is the reading the requesttojoin handler was fixed away from.</summary>
     public int Joinability { get; set; } = 0;
 
     /// <summary>Drives the wire <c>AllowJuniors</c> bool. True means
@@ -83,6 +85,15 @@ public class ClubEntity
     /// browse.</summary>
     public int ClubType { get; set; } = 0;
 
+    /// <summary>Minimum account level required to join, surfaced as the wire
+    /// <c>MinLevel</c> and set by <c>PUT club/{id}/minlevel</c>. 0 = no gate.</summary>
+    public int MinLevel { get; set; } = 0;
+
+    /// <summary>Whether the club's chat channel is available. Drives the wire
+    /// <c>ClubChatEnabled</c> and is the negation of what
+    /// <c>GET club/{id}/hasDisabledClubChat</c> answers.</summary>
+    public bool ClubChatEnabled { get; set; } = true;
+
     public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
     public DateTime UpdatedAt { get; set; } = DateTime.UtcNow;
 }